openSUSE Security Update : MozillaFirefox (openSUSE-2020-1919)

This update for MozillaFirefox fixes the following issues : - Firefox Extended Support Release 78.4.1 ESR - Fixed: Security fix MFSA 2020-49 bsc1178588 - CVE-2020-26950 bmo1675905 Write side effects in MCallGetProperty opcode not accounted for This update was imported from the SUSE:SLE-15:Update...

Oracle Linux 6 : firefox (ELSA-2020-5104)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5104 advisory. 78.4.1-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one Tue Nov 10 2020 [email protected] - 78.4.1-1 -...

Security fix for the ALT Linux 10 package thunderbird version 78.4.2-alt1

Nov. 11, 2020 Andrey Cherepanov 78.4.2-alt1 - New version 78.4.2. - Fixes: + CVE-2020-26950 Write side effects in MCallGetProperty opcode not accounted for...

Mozilla Thunderbird Security Advisory (MFSA2020-49) - Windows

Mozilla Thunderbird is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...

Class destructors causing side-effects when being unserialized

Calling unserialize on malicious user-submitted content can result in the following scenarios:...

ThinkPHP - Multiple PHP Injection RCEs (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ThinkPHP Multiple PHP Injection RCEs', 'Description' = %q This module exploits one of two PHP injection vulnerabilities in the ThinkPHP web...

ThinkPHP 5.0.23 Remote Code Execution Exploit

This Metasploit module exploits one of two PHP injection vulnerabilities in the ThinkPHP web framework to execute code as the web user. Versions up to and including 5.0.23 are exploitable, though 5.0.23 is vulnerable to a separate vulnerability. The module will automatically attempt to detect the...

DEBIAN-CVE-2020-11725

sndctlelemadd in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info-owner line, which later affects a privatesizecount multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were...

Code injection

sndctlelemadd in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info-owner line, which later affects a privatesizecount multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were...

Pandora FMS Ping Authenticated Remote Code Execution

This module exploits a vulnerability found in Pandora FMS 7.0NG and lower. nettools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

PHP-FPM 7.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PHP-FPM Underflow RCE', 'Description' = %q This module exploits an underflow vulnerability in versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and...

Install Python for Windows

This module places an embeddable Python3 distribution onto the target file system, granting pentesters access to a lightweight Python interpreter. This module does not require administrative privileges or user interaction with installation prompts. This module requires Metasploit:...

Centreon 19.10.5 - (Pollers) Remote Command Execution Exploit

Exploit for php platform in category web applications This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Centreon Poller Authenticated Remote Command Execution', 'Description' = %q TODO , 'Author'...

CVE-2019-19118

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

CVE-2019-19118

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

Possible deserialization side-effects in symfony/cache

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...

Possible deserialization side-effects in symfony/cache

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...

Possible deserialization side-effects in symfony/cache

Third party component symfony/cache could have been potentially leading to removal of arbitrary files in combination with other insecure deserialization vulnerabilities...